Crypto Flexs
  • DIRECTORY
  • CRYPTO
    • ETHEREUM
    • BITCOIN
    • ALTCOIN
  • BLOCKCHAIN
  • EXCHANGE
  • ADOPTION
  • TRADING
  • HACKING
  • SLOT
  • TRADE
Crypto Flexs
  • DIRECTORY
  • CRYPTO
    • ETHEREUM
    • BITCOIN
    • ALTCOIN
  • BLOCKCHAIN
  • EXCHANGE
  • ADOPTION
  • TRADING
  • HACKING
  • SLOT
  • TRADE
Crypto Flexs
Home»HACKING NEWS»Wormhole Worldcoin World ID State Root Bridge
HACKING NEWS

Wormhole Worldcoin World ID State Root Bridge

By Crypto FlexsNovember 26, 20243 Mins Read
Facebook Twitter Pinterest LinkedIn Tumblr Email
Wormhole Worldcoin World ID State Root Bridge
Share
Facebook Twitter LinkedIn Pinterest Email

The Wormhole Worldcoin World ID State Root Bridge protocol makes it possible to bridge the Worldcoin World ID state root from Ethereum to Solana. Worldcoin World ID utilizes: semaphoreThere is a single set containing the public key (or identity promise) for each verified user. Promises for this set are replicated to another blockchain, in this case Solana, where the new Merkle root is stored, allowing verified users to prove their identity.

Wormhole partnered with Ackee Blockchain Security to conduct a security review of the Wormhole Worldcoin World ID State Root Bridge protocol over a total of 11 engineering days from September 6 to September 27, 2024.

methodology

The audit began with understanding the high-level goals of the project, followed by a deeper analysis of the logic of the program. In the early stages we implemented fuzz testing, which was particularly helpful for two reasons. The goal was to increase understanding of the core concepts of the project and to start fuzzing as soon as possible to increase the likelihood of bug identification. For fuzzing we use trident. reference pull request With complete fuzz test code.

In the later stages of the audit, we focused on a manual review of the project, paying special attention to:

  • Ensure that preemption is not possible during the initialization process (e.g. configuration initialization).
  • Ensures that all configuration-related commands can only be executed by the relevant permissions.
  • Ensures correct deserialization and serialization of command input.
  • It ensures that reinitialization or denial of service is impossible while Guardian signatures are published to the Solana blockchain.
  • Ensures that there is no possibility of spoofing Guardian Signatures and Guardian Set accounts when publishing new state roots on the Ethereum blockchain.
  • It ensures that all published guardian signatures are verified sequentially and that signatures are not posted multiple times to artificially achieve quorum.
  • Ensure that personal identity verification processes are implemented correctly and that there are no sensitive data leaks.

range

An audit has been performed on the commit. 70f034 and a6f479 The respective ranges are as follows:

Findings

The audit results are as follows:

critical severity

No critical severity issues were found.

Severity High

H1: The latest available root may be inactive and potentially undesirably removed.

medium severity

M1: Arithmetic overflow may occur during route is_active check
M2: Missing mut forcing

low severity

No low-severity issues were found.

warning severity

W1: Reinitializable

Information Severity

I1: Signature malleability due to accommodating high and low order S values

conclusion

The review resulted in five findings ranging from information to high severity. The most severe result, H1, indicates a possible denial of service during identity verification. In Ethereum, if there is a relatively large gap (compared to root_expiry) between newly submitted root hashes, two undesirable scenarios can occur:

Ackee Blockchain Security recommends Wormhole.

  • Always ensure that there is at least one active root available for verification and avoid the possibility of all roots being removed.
  • Ensure that off-chain components function properly and adhere to best security practices.
  • Ensure that Guardian Set accounts stored on chain are well protected and that there is no possibility for an attacker to tamper with these accounts.
  • Do not use unchecked arithmetic. Although the likelihood of exploiting unchecked arithmetic in an unintended way may be low, the potential problem still exists and can have catastrophic consequences.

Ackee Blockchain Security’s full Wormhole audit report, which includes a detailed description of all findings and recommendations, can be found here.

We were delighted to appreciate Wormhole and look forward to working with them again.

Share. Facebook Twitter Pinterest LinkedIn Tumblr Email

Related Posts

The mindset of Retail Investors

July 3, 2025

$ 90m NOBITEX HACK: Fault by layer

July 1, 2025

Safe smart account audit summary

June 27, 2025
Add A Comment

Comments are closed.

Recent Posts

The Complete Guide to Crypto Website Listing Directories

July 5, 2025

Crypto Directories Listing That Will Transform Your Project’s Reach

July 5, 2025

The Ultimate Guide to Hiring a Crypto Marketing Agency

July 5, 2025

Six high upside encryption coins of less than $ 20 are seen in 2025.

July 5, 2025

Valhalla Goes Today: FLOKI has been developed for 3 years and debuts the play MMORPG.

July 4, 2025

The Open Platform Is First Unicorn In Web3 Ecosystem In Telegram At $1bn Valuation

July 3, 2025

The mindset of Retail Investors

July 3, 2025

Cooking.City Bringing Back Value Redistribution To Solana Fair Launches

July 3, 2025

XRP rebounds are interested in APT miners cloud mining.

July 3, 2025

The market will select US regulatory stable coins more than CBDCS every day of CBDCS every day.

July 3, 2025

Best Crypto PR Agency Packages : What to Look For & Where to Start

July 3, 2025

Crypto Flexs is a Professional Cryptocurrency News Platform. Here we will provide you only interesting content, which you will like very much. We’re dedicated to providing you the best of Cryptocurrency. We hope you enjoy our Cryptocurrency News as much as we enjoy offering them to you.

Contact Us : Partner(@)Cryptoflexs.com

Top Insights

The Complete Guide to Crypto Website Listing Directories

July 5, 2025

Crypto Directories Listing That Will Transform Your Project’s Reach

July 5, 2025

The Ultimate Guide to Hiring a Crypto Marketing Agency

July 5, 2025
Most Popular

Bracket Labs expands cross-chain to provide a pipeline for volatility trading products to over 1 million users on the BNB chain.

February 1, 2024

Coin Center Executive Director Jerry Brito will leave the organization at the end of the year.

October 1, 2024

GitHub: Essential Git commands every developer should master

June 10, 2024
  • Home
  • About Us
  • Contact Us
  • Disclaimer
  • Privacy Policy
  • Terms and Conditions
© 2025 Crypto Flexs

Type above and press Enter to search. Press Esc to cancel.